models: user affiliations schema disallow html attrs

[zzacharo]

❤️ Thank you for your contribution!

Description

Please describe briefly your pull request.

Checklist

Ticks in all boxes and 🟢 on all GitHub actions status checks are required to merge:

• I'm aware of the code of conduct.
• I've created logical separate commits and followed the commit message format.
• I've added relevant test cases.
• I've added relevant documentation.
• I've marked translation strings (for relevant code).
• I've followed the CSS/JS and React guidelines (for relevant code).
• I've followed the web accessibility guidelines (for relevant code).
• I've followed the user interface guidelines (for relevant code).
• I've identified the copyright holder(s) and updated copyright headers for touched files (>15 lines contributions).
• I've NOT included third-party code (copy/pasted source code or new dependencies).

Third-party code

If you've added third-party code (copy/pasted or new dependencies), please reach out to an architect.

Reminder

By using GitHub, you have already agreed to the GitHub’s Terms of Service including that:

1. You license your contribution under the same terms as the current repository’s license.
2. You agree that you have the right to license your contribution under the current repository’s license.

[kpsherva]

is it needed? the code should probably not reach here

[zzacharo]

if schema is None it acts as a normal dict...

[kpsherva]

in this case, minor for readability:

Suggested change

	return data
	def _validate(self, data):
	"""Validate the data with the dictionary's schema and return the valid value."""
	if self._schema is None:
	return data
	try:
	# without schema, we basically revert to a normal dictionary
	# with more overhead
	return self._schema.load(data)
	except ValidationError as error:
	raise ValueError(f"Validation failed: {error}")

[lnielsen]

This is not correct. We use sanitised HTML when we want to store and output HTML, and string when we just want text.

[zzacharo]

closing